( ! class_exists( 'WC_Install' ) ) {
				$wc_install_file = WP_PLUGIN_DIR . '/woocommerce/includes/class-wc-install.php';
				if ( file_exists( $wc_install_file ) ) {
					include_once $wc_install_file;
				}
			}

			// Fail safe: if WooCommerce's installer is still unavailable, skip without fatal.
			if ( ! class_exists( 'WC_Install' ) ) {
				return;
			}

			WC_Install::install();
			// Mirror the Elementor precedent: clear the redirect transient so WooCommerce
			// does not try to redirect the headless REST request.
			delete_transient( '_wc_activation_redirect' );
		}

		public static function get_compare_operator_amount( $operand ) {
			$operator = '';
			switch ( $operand ) {
				case 'eq':
					$operator = '=';
					break;
				case 'ge':
					$operator = '>=';
					break;
				case 'le':
					$operator = '<=';
					break;
				case 'gt':
					$operator = '>';
					break;
				case 'lt':
					$operator = '<';
					break;
				default:
					break;

			}

			return $operator;
		}

		public static function get_refs( $all = false, $filter = false ) {
			$refs = array(
				'Facebook'  => array(
					'://fb.com',
					'://m.me',
					'messenger.com',
					'facebook.com',
					'l.facebook.com',
					'meta.com',
				),
				'Google'    => array( 'google' ),
				'Instagram' => array(
					'instagram.com',
					'l.instagram.com',
					'://ig.me',
				),
				'YouTube'   => array( 'youtube' ),
				'Tiktok'    => array( 'tiktok.com' ),
				'Pinterest' => array( 'pinterest.com' ),
				'SnapChat'  => array( 'snapchat.com' ),
				'Yahoo'     => array( 'yahoo' ),
				'X/Twitter' => array(
					'://t.co',
					'twitter.com',
				),

			);

			if ( true === $all ) {
				$refs           = array_merge( array( 'direct' => array() ), $refs );
				$refs['others'] = array();
			}
			if ( true === $filter ) {
				$filters = array();
				foreach ( $refs as $key => $ref ) {

					$filters[ $key ] = ucwords( $key );
				}
				$filters['direct'] = __( 'Direct', 'funnel-builder' );

				return $filters;
			}

			return $refs;
		}

		/**
		 * Check if wc HPOS custom order table enabled.
		 *
		 * @return bool
		 */
		public static function is_wc_hpos_enabled() {
			return ( class_exists( '\Automattic\WooCommerce\Utilities\OrderUtil' ) && method_exists( '\Automattic\WooCommerce\Utilities\OrderUtil', 'custom_orders_table_usage_is_enabled' ) && OrderUtil::custom_orders_table_usage_is_enabled() ) ? true : false;
		}


		public static function get_step_type( $post_type ) {
			switch ( $post_type ) {
				case 'wfacp_checkout':
					$type = 'wc_checkout';
					break;
				case 'wfocu_offer':
					$type = 'wc_upsells';
					break;
				case 'wfocu_funnel':
					$type = 'wc_upsells';
					break;
				case 'wffn_landing':
					$type = 'landing';
					break;
				case 'wffn_ty':
					$type = 'wc_thankyou';
					break;
				case 'wffn_optin':
					$type = 'optin';
					break;
				case 'wffn_oty':
					$type = 'optin_ty';
					break;
				default:
					$type = $post_type;
			}

			return $type;
		}

		public static function oxy_get_meta_prefix( $key ) {
			if ( function_exists( 'oxy_get_meta_prefix' ) ) {
				$key = oxy_get_meta_prefix( $key );
			}

			return $key;
		}

		/**
		 * Re-sign an imported Oxygen template with this site's oxygen_private_key.
		 *
		 * Oxygen signs every shortcode with a per-site key, so a template exported from
		 * another site carries foreign signatures and is rejected on sites that have
		 * signature validation switched on. Running the template through Oxygen's own
		 * parse_shortcodes() -> parse_components_tree() round trip re-emits it signed
		 * with the local key.
		 *
		 * That round trip is lossy though: parse_shortcodes() matches tags with
		 * get_shortcode_regex(), which only knows *registered* shortcodes. During a
		 * template import no FunnelKit Oxygen element is registered (they only boot on
		 * their own step pages and inside the builder), so those shortcodes are parsed
		 * as plain text and come back out of parse_components_tree() bracket-escaped to
		 * _OXY_OPENING_BRACKET_ — the widget is destroyed and renders as literal text on
		 * the front end. Third-party Oxygen add-on elements have the exact same problem.
		 *
		 * So register every tag the template actually uses for the duration of the round
		 * trip, and refuse the result outright if it still came back mangled.
		 *
		 * @param string $content Oxygen shortcode string as exported.
		 *
		 * @return string Re-signed content, or the untouched input when the round trip is
		 *                unavailable or would lose data.
		 */
		public static function oxy_resign_shortcodes( $content ) {
			if ( ! is_string( $content ) || '' === $content ) {
				return $content;
			}

			if ( ! function_exists( 'parse_shortcodes' ) || ! function_exists( 'parse_components_tree' ) ) {
				return $content;
			}

			$registered = self::oxy_register_template_shortcodes( $content );

			$reemit = '';
			$parse  = parse_shortcodes( $content, false, false );

			if ( is_array( $parse ) && ! empty( $parse['is_shortcode'] ) && ! empty( $parse['content'] ) && is_array( $parse['content'] ) ) {
				$reemit = parse_components_tree( $parse['content'] );
			}

			foreach ( $registered as $tag ) {
				remove_shortcode( $tag );
			}

			if ( ! is_string( $reemit ) || '' === $reemit ) {
				return $content;
			}

			/**
			 * Never accept a round trip that escaped brackets the source did not already
			 * contain, or that lost an element entirely. A template left with foreign
			 * signatures still recovers the moment signature validation is turned off (it
			 * is off by default); a mangled template never recovers.
			 */
			if ( substr_count( $reemit, '_OXY_OPENING_BRACKET_' ) > substr_count( $content, '_OXY_OPENING_BRACKET_' ) ) {
				return $content;
			}

			$lost = array_diff( self::oxy_get_shortcode_tags( $content ), self::oxy_get_shortcode_tags( $reemit ) );
			if ( count( $lost ) > 0 ) {
				return $content;
			}

			return $reemit;
		}

		/**
		 * Register every shortcode tag used by an Oxygen template that is not registered
		 * yet, so Oxygen's parser treats all of them as tree nodes.
		 *
		 * The callback is irrelevant — the tags are only ever matched by
		 * get_shortcode_regex(), never executed — and every tag added here is removed
		 * again by the caller as soon as the round trip finishes.
		 *
		 * @param string $content Oxygen shortcode string.
		 *
		 * @return array Tags that were added and must be removed afterwards.
		 */
		private static function oxy_register_template_shortcodes( $content ) {
			$added = array();

			foreach ( self::oxy_get_shortcode_tags( $content ) as $tag ) {
				if ( ! shortcode_exists( $tag ) ) {
					add_shortcode( $tag, '__return_empty_string' );
					$added[] = $tag;
				}
			}

			return $added;
		}

		/**
		 * Collect the distinct opening shortcode tag names used in an Oxygen template.
		 *
		 * @param string $content Oxygen shortcode string.
		 *
		 * @return array
		 */
		private static function oxy_get_shortcode_tags( $content ) {
			if ( ! is_string( $content ) || '' === $content ) {
				return array();
			}

			// Opening tags only — `[/name]` cannot match because `/` is not a name start.
			if ( ! preg_match_all( '/\[([a-z][a-z0-9_-]*)[\s\]]/i', $content, $matches ) ) {
				return array();
			}

			return array_values( array_unique( $matches[1] ) );
		}

		/**
		 * @param $array
		 *
		 * @return array|false
		 */
		public static function array_flatten( $array ) {
			if ( ! is_array( $array ) ) {
				return $array;
			}

			return iterator_to_array( new RecursiveIteratorIterator( new RecursiveArrayIterator( $array ) ), false );
		}

		/**
		 * Get bi-weekly date range
		 *
		 * @return array
		 */
		public static function get_notification_biweekly_range() {
			$dates = array();

			$date = new DateTime( current_time( 'mysql', true ) );
			$date->setTimezone( wp_timezone() );
			if ( 1 !== intval( $date->format( 'N' ) ) ) {
				$date->modify( 'last Monday' );
			}
			$date->setTime( 0, 0, 0 );

			$date->modify( '-14 days' );
			$dates['from_date'] = $date->format( 'Y-m-d' );

			$date->modify( '+13 days' );
			$dates['to_date'] = $date->format( 'Y-m-d' );

			$date->modify( '-14 days' );
			$dates['to_date_previous'] = $date->format( 'Y-m-d' );

			$date->modify( '-13 days' );
			$dates['from_date_previous'] = $date->format( 'Y-m-d' );

			return $dates;
		}

		/**
		 * Get bi-annual (6-monthly) date range
		 *
		 * @return array
		 */
		public static function get_notification_biannually_range() {
			$dates = array();

			$date = new DateTime( current_time( 'mysql', true ) );
			$date->setTimezone( wp_timezone() );
			$current_month = $date->format( 'n' );
			$start_month   = ( $current_month <= 6 ) ? 1 : 7;
			$date->setDate( $date->format( 'Y' ), $start_month, 1 );
			$date->setTime( 0, 0, 0 );

			$dates['from_date'] = $date->format( 'Y-m-d' );
			$date->modify( '+5 months' )->modify( 'last day of this month' );
			$dates['to_date'] = $date->format( 'Y-m-d' );

			$date->modify( '-6 months' )->modify( 'first day of this month' );
			$dates['from_date_previous'] = $date->format( 'Y-m-d' );
			$date->modify( 'last day of this month' );
			$dates['to_date_previous'] = $date->format( 'Y-m-d' );

			return $dates;
		}

		/**
		 * Get yearly date range
		 *
		 * @return array
		 */
		public static function get_notification_yearly_range() {
			$dates = array();

			$date = new DateTime( current_time( 'mysql', true ) );
			$date->setTimezone( wp_timezone() );
			$current_year = $date->format( 'Y' );
			$date->setDate( $current_year, 1, 1 );
			$date->setTime( 0, 0, 0 );

			$dates['from_date'] = $date->format( 'Y-m-d' );
			$date->modify( 'last day of December' );
			$dates['to_date'] = $date->format( 'Y-m-d' );

			$date->modify( '-1 year' )->setDate( $date->format( 'Y' ), 1, 1 );
			$dates['from_date_previous'] = $date->format( 'Y-m-d' );
			$date->modify( 'last day of December' );
			$dates['to_date_previous'] = $date->format( 'Y-m-d' );

			return $dates;
		}

		/**
		 * Get weekly date range
		 *
		 * @return array
		 */
		public static function get_notification_week_range() {
			$dates = array();

			$date = new DateTime( current_time( 'mysql', true ) );
			$date->setTimezone( wp_timezone() );
			if ( 1 !== intval( $date->format( 'N' ) ) ) {
				$date->modify( 'last Monday' );
			}
			$date->setTime( 0, 0, 0 );

			$date = $date->modify( '-7 day' );

			$dates['from_date'] = $date->format( 'Y-m-d' );

			$date = $date->modify( '+6 day' );

			$dates['to_date'] = $date->format( 'Y-m-d' );

			$date = $date->modify( '-7 day' );

			$dates['to_date_previous'] = $date->format( 'Y-m-d' );

			$date = $date->modify( '-6 day' );

			$dates['from_date_previous'] = $date->format( 'Y-m-d' );

			return $dates;
		}

		/**
		 * Get last month date range
		 *
		 * @return array
		 * @throws DateMalformedStringException
		 */
		public static function get_notification_month_range() {
			$dates = array();

			$date = new DateTime( current_time( 'mysql', true ) );
			$date->setTimezone( wp_timezone() );
			$date->modify( 'last Month' );
			$date->setDate( $date->format( 'Y' ), $date->format( 'm' ), 1 );
			$date->setTime( 0, 0, 0 );

			$dates['from_date'] = $date->format( 'Y-m-d' );

			$last_month = clone $date;

			$date->modify( 'last day of this month' );
			$dates['to_date'] = $date->format( 'Y-m-d' );

			$last_month->modify( 'last Month' );
			$last_month->setDate( $last_month->format( 'Y' ), $last_month->format( 'm' ), 1 );

			$dates['from_date_previous'] = $last_month->format( 'Y-m-d' );

			$last_month->modify( 'last day of this month' );
			$dates['to_date_previous'] = $last_month->format( 'Y-m-d' );

			return $dates;
		}
		/**
		 * Get last day date range
		 *
		 * @return array
		 * @throws DateMalformedStringException
		 */
		public static function get_notification_day_range() {
			$dates = array();

			$date = new DateTime( current_time( 'mysql', true ) );
			$date->setTimezone( wp_timezone() );
			$date->modify( '-1 day' );
			$date->setTime( 0, 0, 0 );

			$dates['from_date'] = $date->format( 'Y-m-d' );
			$dates['to_date']   = $date->format( 'Y-m-d' );

			$date->modify( '-1 day' );

			$dates['from_date_previous'] = $date->format( 'Y-m-d' );
			$dates['to_date_previous']   = $date->format( 'Y-m-d' );

			return $dates;
		}

		/**
		 * get desired store time
		 *
		 * @param $hours
		 * @param $mins
		 * @param $sec
		 *
		 * @return int
		 */
		public static function get_store_time( $hours = 0, $mins = 0, $sec = 0 ) {
			$timezone = new DateTimeZone( wp_timezone_string() );
			$date     = new DateTime();

			$date->setTimezone( $timezone );
			$date->setTime( $hours, $mins, $sec );

			if ( time() > $date->getTimestamp() ) {
				$date->modify( '+1 days' );
			}
			return $date->getTimestamp();
		}
		/**
		 * get Stripe State
		 *
		 * @return array
		 */
		public static function stripe_state() {
			if ( self::is_wc_square_active() ) {
				return array(
					'status'     => 'connected',
					'show_pitch' => false,
				);
			}

			$all_plugins = get_plugins();

			$other_stripe_exists = ( defined( 'WC_STRIPE_VERSION' ) || defined( 'WC_STRIPE_PLUGIN_FILE_PATH' ) );

			if ( isset( $all_plugins['funnelkit-stripe-woo-payment-gateway/funnelkit-stripe-woo-payment-gateway.php'] ) ) {

				if ( is_plugin_active( 'woocommerce/woocommerce.php' ) && is_plugin_active( 'funnelkit-stripe-woo-payment-gateway/funnelkit-stripe-woo-payment-gateway.php' ) && class_exists( '\FKWCS\Gateway\Stripe\Admin' ) ) {
					if ( \FKWCS\Gateway\Stripe\Admin::get_instance()->is_stripe_connected() ) {
						return array( 'status' => 'connected' );

					} else {
						return array(
							'status'       => 'not_connected',
							'link'         => \FKWCS\Gateway\Stripe\Admin::get_instance()->get_connect_url(),
							'other_exists' => $other_stripe_exists,
						);

					}
				} else {
					return array(
						'status'       => 'not_activated',
						'other_exists' => $other_stripe_exists,
					);

				}
			} else {
				return array(
					'status'       => 'not_installed',
					'other_exists' => $other_stripe_exists,
				);
			}
		}

		/**
		 * Check if WooCommerce Square is active.
		 *
		 * @return bool
		 */
		public static function is_wc_square_active(): bool {
			return wffn_is_plugin_active( 'woocommerce-square/woocommerce-square.php' ) || class_exists( 'WooCommerce_Square_Loader' );
		}

		/**
		 * get Square State
		 *
		 * @return array
		 */
		public static function square_state() {
			if ( ! self::is_wc_square_active() ) {
				return array(
					'status'     => 'gate_not_met',
					'show_pitch' => false,
				);
			}

			$all_plugins = get_plugins();

			if ( isset( $all_plugins['funnelkit-payment-gateway-square-for-woocommerce/funnelkit-square.php'] ) ) {
				if ( is_plugin_active( 'woocommerce/woocommerce.php' ) && is_plugin_active( 'funnelkit-payment-gateway-square-for-woocommerce/funnelkit-square.php' ) ) {
					if ( class_exists( '\FKWCSQ\Square' ) && \FKWCSQ\Square::is_configured() ) {
						return array( 'status' => 'connected' );
					}

					$link = admin_url( 'admin.php?page=bwf&path=/square-connect' );
					if ( class_exists( '\FKWCSQ\Includes\Modules\Connection\MiddleWare' ) ) {
						$middleware = \FKWCSQ\Includes\Modules\Connection\MiddleWare::get_instance();
						if ( method_exists( $middleware, 'get_connection_url' ) ) {
							$middleware_link = $middleware->get_connection_url();
							if ( ! empty( $middleware_link ) ) {
								$link = $middleware_link;
							}
						}
					}

					return array(
						'status' => 'not_connected',
						'link'   => $link,
					);
				}

				return array( 'status' => 'not_activated' );
			}

			return array( 'status' => 'not_installed' );
		}

		/**
		 * Add order URL for single order ID
		 *
		 * @param int $order_id Order ID
		 * @return string Order edit URL
		 */
		public static function add_order_urls( $order_id ): string {
			if ( empty( $order_id ) ) {
				return '';
			}

			$order_id = absint( $order_id );

			if ( $order_id <= 0 ) {
				return '';
			}

			$hpos_enabled = BWF_WC_Compatibility::is_hpos_enabled();

			if ( $hpos_enabled ) {
				return admin_url( "admin.php?page=wc-orders&action=edit&id={$order_id}" );
			} else {
				return admin_url( "post.php?post={$order_id}&action=edit" );
			}
		}

		/**
		 * Returns the current version of the specified builder plugin.
		 *
		 * For all builder plugins that support templates, this method returns the current version of the builder plugin.
		 *
		 * @param string $builder The builder plugin identifier (e.g., 'elementor', 'divi', 'oxy').
		 * @return string The version of the builder plugin, or an empty string if not found.
		 */
		public static function get_builder_version( $builder ) {
			try {
				if ( $builder === 'elementor' ) {
					return ELEMENTOR_VERSION;
				}

				if ( $builder === 'divi' || $builder === 'divi5' ) {
					return defined( 'ET_BUILDER_PRODUCT_VERSION' ) ? ET_BUILDER_PRODUCT_VERSION : '';
				}

				if ( $builder === 'oxy' ) {
					return CT_VERSION;
				}
			} catch ( Throwable $e ) {
				// Silently fail to prevent breaking main functionality
			}

			return '';
		}

		/**
		 * Check if Elementor Container feature is active
		 *
		 * @return bool True if Container is active, false otherwise
		 */
		public static function is_elementor_container_active() {
			try {
				if ( ! class_exists( '\Elementor\Plugin' ) || ! isset( \Elementor\Plugin::$instance->experiments ) ) {
					return false;
				}

				$experiments = \Elementor\Plugin::$instance->experiments;

				return $experiments->is_feature_active( 'container' );
			} catch ( Throwable $e ) {
				return false;
			}
		}

		public static function sanitize_global_css( $css ) {
			if ( ! is_string( $css ) || '' === $css ) {
				return '';
			}

			// Unwrap, don't delete, <style> wrappers a merchant may have pasted around their CSS —
			// strip only the literal tags and keep the declarations inside (wp_strip_all_tags used to
			// wipe the whole block, silently destroying legitimate CSS).
			$css = preg_replace( '#</?\s*style\b[^>]*>#i', '', $css );

			// Remove only tag openers (`<` followed by a letter, `!` or `/`) so a `</style><script>…`
			// breakout is neutralized without eating `>` child combinators or a literal `<` in a value.
			$css = preg_replace( '#<\s*(?=[a-z!/])#i', '', $css );

			// Legacy CSS-context vectors, scoped so they never touch selector/identifier names.
			$css = preg_replace( '/expression\s*\(/i', '', $css );   // IE expression().
			$css = preg_replace( '/-moz-binding\s*:/i', '', $css );  // XBL binding.

			// Strip javascript:/vbscript: only when used as a protocol inside url( … ) — a bare
			// `javascript:` elsewhere in CSS is inert, and stripping it globally mangled selectors.
			$css = preg_replace_callback(
				'#url\(\s*([\'"]?)(.*?)\1\s*\)#is',
				static function ( $matches ) {
					$clean = preg_replace( '/(?:javascript|vbscript)\s*:/i', '', $matches[2] );
					if ( $clean === $matches[2] ) {
						return $matches[0]; // No dangerous protocol — keep the url() token byte-identical.
					}

					return 'url(' . $matches[1] . $clean . $matches[1] . ')';
				},
				$css
			);

			// `behavior:` only as a declaration (start of file, or after `;`/`{`), never inside a
			// selector such as `.behavior:hover`.
			$css = preg_replace( '/(^|[;{]\s*)behavior\s*:/i', '$1', $css );

			return $css;
		}

		/**
		 * Allow-listed iframe src origins permitted inside script fields.
		 *
		 * Matched case-insensitively as a URL prefix against each iframe's src by
		 * sanitize_global_script(). Add trusted embed origins to the array
		 * (keep in sync with the JS sanitizer's ALLOWED_IFRAME_SRC).
		 *
		 * @return string[]
		 */
		public static function get_allowed_iframe_src() {
			// Iframe src origins allowed inside script fields (case-insensitive prefix
			// match). Add future trusted embed origins to this array.
			return array(
				'https://www.googletagmanager.com',
			);
		}

		public static function sanitize_global_script( $script ) {
			// (1) Dangerous standalone tags.
			$script = preg_replace( '#<\s*/?\s*base\b[^>]*>#i', '', $script );
			$script = preg_replace( '#<\s*/?\s*link\b[^>]*>#i', '', $script );
			$script = preg_replace( '#<\s*meta\b[^>]*http-equiv\s*=\s*["\']?\s*refresh[^>]*>#i', '', $script );
			$script = preg_replace( '#<\s*/?\s*(?:object|embed)\b[^>]*>#i', '', $script );
			// Strip iframes EXCEPT those whose src is explicitly allow-listed (e.g. the
			// Google Tag Manager <noscript> fallback). Closing </iframe> tags are left
			// as-is (harmless: kept for allowed iframes, orphaned for removed ones).
			$allowed_iframe_src = self::get_allowed_iframe_src();
			$script             = preg_replace_callback(
				'#<\s*iframe\b[^>]*>#i',
				static function ( $m ) use ( $allowed_iframe_src ) {
					if ( is_array( $allowed_iframe_src ) && count( $allowed_iframe_src ) > 0 && preg_match( '#\ssrc\s*=\s*["\']?\s*([^"\'\s>]+)#i', $m[0], $src_m ) ) {
						$src        = strtolower( $src_m[1] );
						$src_scheme = wp_parse_url( $src, PHP_URL_SCHEME ) ?: '';
						$src_host   = wp_parse_url( $src, PHP_URL_HOST ) ?: '';
						$src_port   = wp_parse_url( $src, PHP_URL_PORT );
						foreach ( $allowed_iframe_src as $prefix ) {
							$pfx      = strtolower( $prefix );
							$pfx_host = wp_parse_url( $pfx, PHP_URL_HOST ) ?: '';
							if ( '' !== $pfx_host && $src_host === $pfx_host && $src_scheme === ( wp_parse_url( $pfx, PHP_URL_SCHEME ) ?: '' ) && $src_port === wp_parse_url( $pfx, PHP_URL_PORT ) ) {
								return $m[0];
							}
						}
					}

					return '';
				},
				$script
			);
			$script             = preg_replace( '#<\s*(?:set|animate[a-z]*)\b[^>]*\battributeName\s*=\s*["\']?\s*(?:on|href|xlink)[^>]*>#i', '', $script );

			// (2) Dangerous attributes / inline-URI protocols.
			$script = preg_replace( '#\son[a-z]+\s*=\s*("[^"]*"|\'[^\']*\'|[^\s>]+)#i', '', $script );
			$script = preg_replace( '#\bsrcdoc\s*=#i', ' data-blocked-srcdoc=', $script );
			$script = preg_replace( '#\s(?:href|src|action|formaction|xlink:href)\s*=\s*(["\']?)\s*(?:javascript|vbscript|data:\s*text/html)[^\s>"\']*\1?#i', '', $script );

			// (3) Inline JS sink signatures.
			$sinks = array(
				'#\bimport\s*\(\s*[^)]*[\'"`]\s*\+#i',
				'#\b(?:import|fetch)\s*\(\s*[\'"`][^\'"`]*\\\\(?:x[0-9a-f]{2}|u[0-9a-f]{4}|[0-7]{1,3})#i',
				'#\bimport\s*\(\s*[^)]*\b(?:location|document|window|self|top|name|atob|unescape|decodeURI|localStorage|sessionStorage)\b#i',
				'#\b(?:import|fetch|eval|Function)\s*\(\s*atob\s*\(#i',
				'#(?:\.\s*then\s*\(\s*|=>\s*)(?:eval|Function|new\s+Function)\b#i',
				'#\bdocument\s*\.\s*cookie\b#i',
				'#\blocation(?:\s*\.\s*(?:href|replace|assign))?\s*(?:=(?!=)|\(\s*)\s*(?:atob|unescape|decodeURI|decodeURIComponent|String\s*\.\s*fromCharCode)\s*\(#i',
				'#\bnew\s+Function\s*\(#i',
				'#\b(?:setTimeout|setInterval)\s*\(\s*[\'"`]#i',
				'#\bnew\s+WebSocket\s*\(#i',
				'#\bnew\s+Blob\s*\([^)]*(?:java|ecma)script#i',
				'#createObjectURL#i',
				'#data:\s*(?:text|application)/(?:java|ecma)script[^,]*;\s*base64\s*,[A-Za-z0-9+/=]*#i',
				'#fromCharCode[\'"\]\s)]*\([^)]*\^#i',
				'#(?:0x[0-9a-f]{1,2}\s*,\s*){8,}#i',
				'#(?:window|top|self|globalThis|document)\s*\[\s*[\'"][^\'"]{1,8}[\'"]\s*\+#i',
				'#(?:\\\\x[0-9a-f]{2}){16,}#i',
			);

			// (4) Remove whole <script> blocks that decode-and-execute, or carry a sink.
			$script = preg_replace_callback(
				'#<script[^>]*>(.*?)</script>#is',
				static function ( $m ) use ( $sinks ) {
					$b = $m[1];
					for ( $i = 0; $i < 5 && ( $d = html_entity_decode( $b, ENT_QUOTES | ENT_HTML5, 'UTF-8' ) ) !== $b; $i++ ) {
						$b = $d;
					}

					$decode = preg_match( '#\batob\s*\(#i', $b ) + preg_match( '#fromCharCode#i', $b )
						+ preg_match( '#\^\s*0x?[0-9a-f]+#i', $b ) + preg_match( '#(?:0x[0-9a-f]{1,2}\s*,\s*){8,}#i', $b )
						+ preg_match( '#\bunescape\s*\(#i', $b ) + preg_match( '#decodeURIComponent\s*\([^)]{40,}#i', $b );
					$exec   = preg_match( '#\beval\s*\(#i', $b ) + preg_match( '#\bnew\s+Function\s*\(#i', $b )
						+ preg_match( '#createObjectURL#i', $b ) + preg_match( '#\bnew\s+WebSocket\s*\(#i', $b )
						+ preg_match( '#createElement[\'"\]\s]*\(?\s*[\'"]script#i', $b ) + preg_match( '#\bimport\s*\(#i', $b )
						+ preg_match( '#\b(?:setTimeout|setInterval)\s*\(\s*[\'"`]#i', $b );
					$reach  = preg_match( '#(?:appendChild|insertBefore|\.append|\[\s*[\'"]append)#i', $b )
						+ preg_match( '#[\.\[][\'"]?\s*src\s*[\'"\]]*\s*=#i', $b ) + preg_match( '#document\s*\.\s*write#i', $b );

					if ( ( $decode >= 1 && $exec >= 1 ) || ( $exec >= 2 && $reach >= 1 ) ) {
						return '';
					}
					// atob() + any script-injection scaffold (catches createElement(variable), .src = atob(...), etc.).
					if (
						preg_match( '#\batob\s*\(#i', $b ) &&
						(
							preg_match( '#\bcreateElement\s*\(#i', $b ) ||
							preg_match( '#[\.\[][\'"]?\s*src\s*[\'"\]]*\s*=#i', $b ) ||
							preg_match( '#(?:appendChild|insertBefore|\.append)\s*\(#i', $b )
						)
					) {
						return '';
					}
					foreach ( $sinks as $re ) {
						if ( preg_match( $re, $b ) ) {
							return '';
						}
					}
					return $m[0];
				},
				$script
			);

			// (5) Final sweep for sinks left outside <script>.
			foreach ( $sinks as $re ) {
				$script = preg_replace( $re, '', $script );
			}

			return $script;
		}

		/**
		 * Enqueue the WebFont loader used by the block editors' font pickers.
		 *
		 * @param string $webfont_handle Handle to register/enqueue the WebFont loader script under.
		 */
		public static function enqueue_block_editor_webfont_loader( $webfont_handle = 'bwf-web-font' ) {
			wp_register_script( $webfont_handle, WFFN_PLUGIN_URL . '/assets/js/webfont-loader.js', array(), WFFN_VERSION_DEV, true );
			wp_enqueue_script( $webfont_handle );
		}
	}

}